BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
29
Global rank
40 infographic chevron month
Month rank
67 infographic chevron week
Week rank
313
IOCs

Troldesh is ransomware — a malware that demands a payment in order to unlock encrypted files. It is also can search and steal information from the banking programs if such are found on the infected machine.

Ransomware
Type
Unknown
Origin
1 January, 2014
First seen
14 April, 2024
Last seen
Also known as
Encoder.858

How to analyze Troldesh with ANY.RUN

Type
Unknown
Origin
1 January, 2014
First seen
14 April, 2024
Last seen

IOCs

IP addresses
74.220.207.61
62.212.69.227
136.243.4.139
185.220.101.193
141.105.66.243
Hashes
34f3e2a247fecfa3a54d6436836f6006c0d027ddad59d69d270a42b2d02a3c83
ea953d7013897fd769ccc86a271ac536fb87c72d3a988beda738b62bc1f79eef
217ba55e45a75b35a394557231d7ef24c986eba96a33585b8acd75a5b613fe4c
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
b370a4f93fb6e655f131329f027615c6828cdfc7002d7b0692f5d28e952c2194
e32998012af31476e39dedb2f725269dbd0a165d74b53a32e5e359da3a01221d
324aa9beab7d27ec774ea3e17646276312328132155ecb870c30f57807bdd31f
b7d5c66725810c90c16eac28adfed02a40ea845d38f7a2ff2d6020c1092f21b7
19249c94b4ea562a7578bba2263418eb97a7fcf2f0a8a75ec8cc7c3110ceda6d
5dad38df1d5870a8d05274c31ad930c8ded6cc6d9a2364a86d7a5cea17b5e9bb
50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83
51d0aaeab5478e535162cc12888d2e3e2d4f41367f9815cc4fabb5541531b299
9745acdd43f9314da7e8ff140501f224bf5b57fb8875f740e8189981623c7f9e
4486ecf3f3498975deb6bc982ee6c543d1453cd55fd35662eef7dc7878c3e407
1b12d30cff936e5ad9dcb03afb9f06487f0fca1ba32607900833ce1574a5af53
fd03dd58aa7cb5236f4df8cde3fb07af304c6f402cd48b86eefcecb8e7b86883
2173186bbe4f2019c4a05ca4ace21016162e600f2836b7c0e0ea3d1bf3d5ea05
9ea254371b091687941c755963053907ef54ef77716d3a6d7d283bcd54351295
379b874a71a6e1c10a55a38b8bdb4039004ac983553b16f483696b376b412eab
5cfb6536059e5a9aaab41b4274c234f67e84609c5edbc872da41c14312b5b5ab
Domains
2vvby3tu.com
apifortraffic.xyz
onegoogleupdatetag.xyz
b2afikprcfzqdbcv.onion
cashagain.xyz
ultimategoogle.xyz
officeresearcher.xyz
streetofyoursecurity.club
shutyourmix.info
fourthbookdeliver.xyz
gxyvmhc55s4fss2q.onion.to
makemoneywithus.vip
thirdimageupload.xyz
autobitcoingenerator.info
secondimageupload.xyz
harvatiya-ads.info
autobinarysignals.club
male-safe.xyz
cryptorzimsbfbkx.onion
maleagain.xyz
Last Seen at

Recent blog posts

post image
New PowerShell Script Tracer: Analyze PowerSh...
watchers 453
comments 0
post image
Dmitry Marinov: ANY.RUN’s CTO on TI Lookup, S...
watchers 275
comments 0
post image
Malware Trends Report: Q1, 2024
watchers 1830
comments 0

What is Troldesh ransomware?

Troldesh, also known as Encoder.858, is ransomware belonging to the Shade ransomware family. It was created in 2014. The malware encrypts files on the victim's machine and demands a ransom for the data to be restored.

Attempting to get as much information as possible, the malware also scans the target PC for banking files or banking programs to squeeze every last penny.

General description of Troldesh

Attacking Windows users mainly in Russia, Ukraine, and Germany, Troldesh is one of Russia's most commonly used encryption software.

In addition to this behavior, Troldesh ransomware often comes in conjunction with two particular malware samples, namely Mexar, and Teamspy, which allows attackers to control the victim's PC remotely and gives the virus the ability to install other malware, including trojans on the infecting PC.

In fact, unlike most other ransomware Nemty or others, this virus does not stop executing after encrypting the victim's files. Instead, it starts an infinite loop where it requests URLs of other malicious programs from the command server, downloading and installing them on a contaminated machine. This strategy means that most victims contaminated with Troldesh may end up with a whole host of infections on their PC. And even with removal tools and decryptors, it can be challenging to get rid of this issue.

Even though the malware itself has not evolved a lot throughout its lifespan, attackers' method to demand the ransom has changed. The first malware samples were used to provide an email address at which the victim could contact the hackers and negotiate the payment. In newer campaigns, ransom node demands victims to use the Tor browser to navigate to a payment page that is located on the Dark Web.

Trodlesh, as part of the Shade family, shares several familiarities with related malware: they are written in C++, utilize CTL, use a static link with a Tor client. Every particular malware sample also has a hardcoded URL of the command server. Malicious programs of this family are also known to exhibit similar or identical behavior. As such, they create ten identical ransom notes in two languages – Russian and English and name them README1.txt or README10.txt.

Troldesh malware analysis

A video simulation recorded on ANY.RUN allows us to examine the lifecycle of the Troldesh malware in a lot of detail.

process graph of a troldesh ransomware execution Figure 1: Process graph generated by ANY.RUN helps us visualize the life cycle of the virus

Troldesh execution process

Troldesh ransomware is spread in the form of a script file, either Javascript or JScript. Usually, these files are packed in an archive file that is sometimes protected with a password. In the simulation performed on ANY.RUN, after a script file was unpacked and launched, it installed an executable file from the internet. It should be noted that in the case of Troldesh, executable files typically have "not suspicious" extensions along with the likes of .jpg. After being downloaded, the files are renamed and executed.

As shown in the ANY.RUN simulation, after running, the file immediately began performing the malicious activity, namely: encrypting files, stealing personal data, deleting shadow copies, and changing autorun values in the registry. Files encrypted by the latest versions of Troldesh are known to have a .crypted000007 extension which was also the case in our simulation. Lastly, after encryption was completed, the malicious executable file dropped ransomware instructions on the desktop.

process tree of a troldesh ransomware execution Figure 2: Process tree of a Troldesh ransomware execution

How to avoid infection by Troldesh?

Since Troldesh is commonly distributed using malspam campaigns that mimic real company newsletters, a good way of staying safe is thoroughly checking for the authenticity of emails before downloading any attachments. If necessary, one can get in touch with a company that is the presumable author of the newsletter and verify that they have sent the email.

Once infected, Troldesh installs several secondary malware samples on the victim's PC, thus after Troldesh removal – malware deletes itself from the PC, it is vital to conduct a global system scan and make sure that one's machine is not swarming with other viruses as well.

Distribution of Troldesh

Troldesh ransomware is known to utilize two main attack vectors – email spam and exploit kits. Malspam campaigns usually mimic legitimate information newsletters from actual Russian companies, including banks and large supermarket chains. The emails themselves contain an archive file in which another script file is included.

Upon unpacking the archive and clicking on the file, a malicious loader is installed. It in turn downloads and installs the main payload – Troldesh itself. The loader is known to be stored on legitimate but compromised WordPress websites where it is hidden as an image file.

Troldesh is also known to utilize Axpergle and Nuclear exploit kits, and these attacks are, arguably, more dangerous than email spam as they don't require active actions from the user for the contamination process to begin. Instead, upon visiting a compromised URL, which can be a website hosted by the attackers or a legitimate website that has been hacked, the malware utilizes a vulnerability either in the browser itself or in one of the browser plugins, successfully penetrating into the users PC and starting the execution automatically. Thus, victims can get infected without ever realizing the danger, so get a removal program and a decryptor.

Communication with C&C

Address information of C&C servers is embedded in the body of each malware sample. Servers themselves are hosted on the dark web and communication is established with the use of a Tor client.

Once installed on a victim's PC, the malware requests a public key value from the server to encrypt the victim's files. Should the connection attempt fail, the virus uses one of one hundred private key values stored in its memory.

How to detect Troldesh using ANY.RUN?

Since Troldesh ransomware writes into the registry analysts can detect it by looking at registry keys. Choose the process by clicking on it in the process tree of the task then click on the "More info" button. In the "Advanced details of process" window switch to the "Registry changes" tab and take a closer look. If the analyzed sample writes a value "906D0F2E2F604F839E04" with the name "xi" into the key HKLM\SOFTWARE\System32\Configuration it's Troldesh.

Registry changes created by Troldesh Figure 3: Registry changes created by Troldesh

Conclusion

Troldesh is an extremely dangerous ransomware that is able to contaminate victims who simply end up browsing to the wrong place at the wrong time, ending up on a website hacked by the attackers. Unlike much other ransomware that simply demands money in exchange for user's encrypted data, Troldesh doesn't stop there and goes the extra mile to spread other dangerous malware samples on a victim's PC.

Utilizing analysis services like ANY.RUN is a great way to examine the virus from a safe environment and develop a sufficient defense strategy.

P.S.

On the 27th of April, 2020 authors behind Troldesh ransomware announced that they stopped distribution of the ransomware and publish the decryption keys with a decryptor and instructions. They said that apologize to all the victims of the trojan and hope that the keys they published will help them to recover their data. The same scenario had a couple of other ransomware writers, even the infamous Maze.

You can take a look at the task in which their keys and tool were used to decrypt data.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy